5

Here's the scenario:

Your account has multiple active “password reset” links out in the world. They expire after 24 hours, and after you change your password.

Instead of changing your password, you then change your account email. Should the password reset links still be valid? Is it a security risk to not invalidate them?

  • should you not also only have a single valid password reset link? – Richie Frame Apr 25 '18 at 0:22
9

I would argue that yes, you should invalidate them. The email change may be because the email account is compromised. And there is no harm in invalidating them, as the user is clearly logged in and can just request another one if they need to.

That being said, it is much more important to send a verification email to the old mail before you allow a change and if the user lost access, send instead an undo link valid for at least 7 days (ideally more). Otherwise, you risk account theft.

Lastly, if you support 2FA, you should not allow resetting both factors using just email.

PS: Also you should not allow changing mail for a period of time after password reset.

  • 3
    So you say the email account may be compromised, but then suggest sending an email change undo link? – multithr3at3d Apr 24 '18 at 17:43
  • @multithr3at3d I suggested that only if the owner cannot access the confirmation link. And yes, I think it is better to end up in a stalemate between the attacker and the owner than let the account be stolen entirely in some cases. You can make a more elaborate system if you want to solve this, or just enforce 2FA. – Peter Harmann Apr 24 '18 at 17:45
  • 2
    @jdubjdub By writing my last comment, I realized I should add: Also you should not allow changing mail for a period of time after password reset, so that a compromised email can not result in account being taken over entirely. – Peter Harmann Apr 24 '18 at 17:53
  • 1
    I would also argue that you should only have one valid password reset link at a time. If a new link is requested, invalidate the old one because they're telling you they didn't get the first one. So who knows where it ended up? – nbering Apr 24 '18 at 18:59
  • 1
    I think your last 3 points are extremely important. Everyone uses email as a verification method. Depending on what your site is, you may even want to disable extremely sensitive transactions when something as drastic as an email address change happens. (Financial transactions for instance) – Steve Sether Apr 24 '18 at 19:11
1

You shouldn't be able to change your email address if you don't know the password. If you lose both the password and access to the email of record, you're screwed.

  • 1
    yep, we're requiring verification and password to confirm email change already. no way to change email if you don't have access to both emails and password. – jdubjdub Apr 24 '18 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.